Вирус "Adobe Flash Player устарел." В браузерах перекидывает на сайт Goinfo и подобные

begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 TerminateProcessByName('c:\documents and settings\all users\application data\iepluginservices\pluginservice.exe');
 TerminateProcessByName('c:\program files\advplugin\basement\extensionupdaterservice.exe');
 TerminateProcessByName('c:\program files\advplugin\backgroundsingleton.exe');
 SetServiceStart('Rerun service for advPlugin', 4);
 SetServiceStart('Update Service for advPlugin', 4);
 SetServiceStart('IePluginServices', 4);
 StopService('Rerun service for advPlugin');
 StopService('Update Service for advPlugin');
 StopService('IePluginServices');
 QuarantineFile('C:\Documents and Settings\Admin\Local Settings\Temp\CSmVeNkygNS4.exe', '');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\eTranslator\eTranslator.exe', '');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Вoйти в Интeрнет 2inf.net.lnk', '');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\MaxDownload\Updater.exe', '');
 QuarantineFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\advPlugin_restartonfail\InstallAfterRebootService0.exe', '');
 QuarantineFile('C:\Program Files\advPlugin\Toolbar32.dll', '');
 QuarantineFile('C:\Program Files\advPlugin\Interfaces32.dll', '');
 QuarantineFile('c:\documents and settings\all users\application data\iepluginservices\pluginservice.exe', '');
 QuarantineFile('c:\program files\advplugin\basement\extensionupdaterservice.exe', '');
 QuarantineFile('c:\program files\advplugin\backgroundsingleton.exe', '');
 DeleteFile('c:\program files\advplugin\backgroundsingleton.exe', '32');
 DeleteFile('C:\Program Files\advPlugin\Interfaces32.dll', '32');
 DeleteFile('C:\Program Files\advPlugin\Toolbar32.dll', '32');
 DeleteFile('C:\Documents and Settings\All Users\Application Data\IePluginServices\PluginService.exe', '32');
 DeleteFile('C:\Program Files\advPlugin\Basement\ExtensionUpdaterService.exe', '32');
 DeleteFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\advPlugin_restartonfail\InstallAfterRebootService0.exe', '32');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\MaxDownload\Updater.exe', '32');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Вoйти в Интeрнет 2inf.net.lnk', '32');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\eTranslator\eTranslator.exe', '32');
 DeleteFile('C:\Documents and Settings\Admin\Local Settings\Temp\CSmVeNkygNS4.exe', '32');
 DeleteService('Rerun service for advPlugin');
 DeleteService('Update Service for advPlugin');
 DeleteService('IePluginServices');
 DeleteFileMask('C:\Documents and Settings\All Users\Application Data\IePluginServices\', '*', true);
 DeleteDirectory('C:\Documents and Settings\All Users\Application Data\IePluginServices\');
 DeleteFileMask('C:\DOCUME~1\Admin\LOCALS~1\Temp\advPlugin_restartonfail\', '*', true);
 DeleteDirectory('C:\DOCUME~1\Admin\LOCALS~1\Temp\advPlugin_restartonfail\');
 DeleteFileMask('C:\Documents and Settings\Admin\Application Data\MaxDownload\', '*', true);
 DeleteDirectory('C:\Documents and Settings\Admin\Application Data\MaxDownload\');
 DeleteFileMask('c:\program files\advplugin\', '*', true);
 DeleteDirectory('c:\program files\advplugin\');
 DeleteFileMask('C:\Documents and Settings\Admin\Application Data\eTranslator\', '*', true);
 DeleteDirectory('C:\Documents and Settings\Admin\Application Data\eTranslator\');
 DelBHO('{7CE987D5-11B3-44FC-9C3D-03069360D462}');
 DelBHO('{92780B25-18CC-41C8-B9BE-3C9C571A8263}');
 DelBHO('{1FE48F08-A2AC-44AC-A21C-0556D91C50DA}');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'MaxDownload');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'eTranslator Update');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'CSmVeNkygNS4');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'xrbeydkxgi');
BC_ImportAll;
ExecuteRepair(2);
ExecuteRepair(3);
 ExecuteWizard('SCU', 2, 3, true);
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
end.

start
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-1214440339-796845957-1177238915-500\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
FF DefaultSearchEngine: Поиск@Mail.Ru
FF Extension: Спутник @Mail.Ru - C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D} [2015-01-14]
FF Extension: Визуальные закладки @Mail.Ru - C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7} [2015-01-14]
CHR HomePage: Default -> hxxp://mail.ru/cnt/10445?gp=blackbear1
CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=blackbear1"
CHR DefaultSearchKeyword: Default -> go.mail.ru
CHR DefaultSuggestURL: Default -> http://suggests.go.mail.ru/chrome?q={searchTerms}
CHR Extension: (Mail.Ru) - C:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jedelkhanefmcnpappfhachbpnlhomai [2015-01-14]
CHR HKLM\...\Chrome\Extension: [gdknicmnhbaajdglbinpahhapghpakch] - No Path
CHR HKLM\...\Chrome\Extension: [hhjmihalfdochhinhfogciaafppfgpjj] - No Path
CHR HKLM\...\Chrome\Extension: [jdkihdhlegcdggknokfekoemkjjnjhgi] - No Path
CHR HKLM\...\Chrome\Extension: [jedelkhanefmcnpappfhachbpnlhomai] - No Path
CHR HKLM\...\Chrome\Extension: [kneggodalbcmgdkkfhbhbicbbahnacjb] - No Path
CHR HKLM\...\Chrome\Extension: [mofcklffffgbdgnoipdokcclbhomkpie] - No Path
CHR HKLM\...\Chrome\Extension: [pchfckkccldkbclgdepkaonamkignanh] - No Path
CHR HKLM\...\Chrome\Extension: [pganlglbhgfjfgopijbhemcpbehjnpia] - No Path
CHR HKU\S-1-5-21-1214440339-796845957-1177238915-500\...\Chrome\Extension: [kneggodalbcmgdkkfhbhbicbbahnacjb] - No Path
OPR StartupUrls: "hxxp://mail.ru/cnt/10445"
2015-01-28 17:50 - 2015-01-29 14:37 - 00000222 _____ () C:\WINDOWS\Tasks\Уведомлением о завершении поддержки Microsoft Windows XP при входе.job
2015-01-28 17:50 - 2015-01-28 18:21 - 00000216 _____ () C:\WINDOWS\Tasks\Уведомление о завершении поддержки Microsoft Windows XP ежемесячно.job
2015-01-14 19:34 - 2015-01-14 19:34 - 00000000 ____D () C:\Documents and Settings\Admin\Local Settings\Application Data\Вoйти в Интeрнет 2inf.net
2015-01-14 19:29 - 2015-01-14 19:29 - 00000000 ____D () C:\Documents and Settings\Admin\Local Settings\Application Data\Поиcк в Интeрнете
Task: C:\WINDOWS\Tasks\Уведомление о завершении поддержки Microsoft Windows XP ежемесячно.job => C:\WINDOWS\system32\xp_eos.exe
Task: C:\WINDOWS\Tasks\Уведомлением о завершении поддержки Microsoft Windows XP при входе.job => C:\WINDOWS\system32\xp_eos.exe
MSCONFIG\startupreg: amigo => C:\Documents and Settings\Admin\Local Settings\Application Data\Amigo\Application\amigo.exe --no-startup-window
MSCONFIG\startupreg: KometaAutoLaunch_44BC0CBBA3CA618ABBF8EFAE96F4BF0B => "C:\Documents and Settings\Admin\Local Settings\Application Data\Kometa\Application\kometa.exe" --no-startup-window
MSCONFIG\startupreg: MailRuUpdater => C:\Documents and Settings\Admin\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe
EmptyTemp:
Reboot:
end